Security Engineer for Open-Source Web Frameworks

Vercel; San Francisco (CA); On-site; USD 208,000 - 312,000; Full time

Benefits offered by this job

Equity

Health Insurance

Mentorship & Networking

Flexible Time Off

WFH Budget

Job summary

Vercel is seeking a security engineer who thrives on finding systemic vulnerability classes and eliminating them in one move. You’ll perform in-depth assessments of framework internals, drive security fixes at the source, and own coordinated disclosure for major OSS projects across Turborepo/Nuxt/Svelte ecosystems.

You’ll coordinate with maintainers, run the OSS bug bounty program, and help design secure features from the outset.

Qualifications

• Strong JavaScript/TypeScript fundamentals and knowledge of modern meta-frameworks.
• Experience with structured security assessment methodology and responsible disclosure.
• Proven open source contributions and familiarity with OSS security practices.
• Ability to read and reason about framework internals (routing, SSR, bundling).
• Experience in coordinating vulnerability disclosures and advisories.

Responsibilities

• Hunt for vulnerability classes and run deep security assessments of framework internals.
• Drive root-cause framework fixes and upstream design changes.
• Own vulnerability disclosure, CVEs, and coordinated disclosure for OSS projects.
• Manage OSS bug bounty triage, reproduction, and coordination with maintainers.
• Collaborate with framework teams early in RFCs to bake security into design.

Skills

JavaScript/TypeScript

Security engineering

Open source

Coord operations

Vulnerability research

Job description

Vercel is seeking a security engineer who thrives on finding systemic vulnerability classes and eliminating them in one move. You’ll perform in-depth assessments of framework internals, drive security fixes at the source, and own coordinated disclosure for major OSS projects across Turborepo/Nuxt/Svelte ecosystems.

You’ll coordinate with maintainers, run the OSS bug bounty program, and help design secure features from the outset.